CVE-2013-0209
Description
lib/MT/Upgrade.pm in mt-upgrade.cgi in Movable Type 4.2x and 4.3x through 4.38 does not require authentication for requests to database-migration functions, which allows remote attackers to conduct eval injection and SQL injection attacks via crafted parameters, as demonstrated by an eval injection attack against the core_drop_meta_for_table function, leading to execution of arbitrary Perl code.
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
No mitigations published for this CVE yet.
The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.
✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here withsource_tier=community-verified.
Exploits
Public proof-of-concept code below. AS-IS, for defenders and authorised testing only.
Exploit-DB
Movable Type 4.2x/4.3x - Web Upgrade Remote Code Execution (Metasploit)
Metasploit modules
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| sixapart | movable_type | 4.21 | |
| sixapart | movable_type | 4.22 | |
| sixapart | movable_type | 4.23 | |
| sixapart | movable_type | 4.24 | |
| sixapart | movable_type | 4.25 | |
| sixapart | movable_type | 4.26 | |
| sixapart | movable_type | 4.27 | |
| sixapart | movable_type | 4.28 | |
| sixapart | movable_type | 4.29 | |
| sixapart | movable_type | 4.31 | |
| sixapart | movable_type | 4.32 | |
| sixapart | movable_type | 4.33 | |
| sixapart | movable_type | 4.34 | |
| sixapart | movable_type | 4.35 | |
| sixapart | movable_type | 4.36 | |
| sixapart | movable_type | 4.37 | |
| sixapart | movable_type | 4.38 | |
| sixapart | movable_type | 4.261 | |
| sixapart | movable_type | 4.291 | |
| sixapart | movable_type | 4.292 | |
| sixapart | movable_type | 4.361 | |
References
- http://openwall.com/lists/oss-security/2013/01/22/3
- http://www.movabletype.org/2013/01/movable_type_438_patch.html
- http://www.sec-1.com/blog/?p=402
- http://www.sec-1.com/blog/wp-content/uploads/2013/01/movabletype_upgrade_exec.rb_.txt
- http://openwall.com/lists/oss-security/2013/01/22/3
- http://www.movabletype.org/2013/01/movable_type_438_patch.html
- http://www.sec-1.com/blog/?p=402
- http://www.sec-1.com/blog/wp-content/uploads/2013/01/movabletype_upgrade_exec.rb_.txt
CWEs
CWE-287
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.